CVE-2022-2422
Feathers - SQL injection via attribute aliases
| CVE | CVE-2022-2422 | |||||||||||
| Title | Feathers - SQL injection via attribute aliases | |||||||||||
| Case | DIVD-2022-00020 | |||||||||||
| Credits |
|
|||||||||||
| Affected products |
|
|||||||||||
| CVSS |
Base score:
10
(CRITICAL) |
|||||||||||
| References |
|
|||||||||||
| Problem type(s) | CWE-89 SQL Injection | |||||||||||
| Date published | 24 Oct 2022 22:00 UTC | |||||||||||
| Last modified | 02 Jan 2024 18:32 UTC |
Description
Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used.
JSON version.